Authentication
One bearer token, and the key decides whether you are in sandbox or live.
Authorization: Bearer ck_test_2cFVnivrUfRDwfSfJ4LGUikz4tmkV1Gc| Prefix | Environment | Effect |
|---|---|---|
ck_test_ | Sandbox | No money moves |
ck_live_ | Production | Real payments |
Keys are shown once. We store only a
hash, so a lost key cannot be recovered. It has to be replaced. Treat it as a
password: server side only, never in browser code or a mobile app.
What happens without one
{
"error": {
"type": "invalid_request_error",
"code": "unauthorized",
"message": "Invalid or missing API key."
}
}Rate limits
300 authenticated requests a minute. Responses carry
X-RateLimit-Remaining and, when exceeded, Retry-After.
Webhook notification endpoints are not limited.